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CLAIMS: 



A 



A method for identifying an event among a plurality of events detected by a 
network management station on a network, which event is indicative of the 
underlying cause of more than one of said plurality of events, wherein the network 
management station knows the topology of the network, the method comprising the 
steps of: considering the location of the network device causing each event in the 



plurality of events, and dete 
location closest to the network 



ig as said event, the event which has occurred at a 
?ement station. 



2. A method as claimed in clair 
comprises, for each event in the 
devices and/or links between the 
management station. 



^erein the step of considering the location 
rakfo-j&re vents, determining the number of 
ice causing the event and the network 



3. A method as claimed in claim 2, wHerein the step of determining the number 
of devices and/or links between the device causing the event and the network 
management station comprises the steps of: determining the shortest path between the 
device causing the event and the network management station using the topology of 
the network and calculating the number of devipes and/or links in the determined 
shortest path. 



4. A method as claimed in claim 2, further compVising the step of: receiving each 
event, and automatically determining the number of davices and/or links between the 
device causing the event and the network management smtion. 



5. A method as claimed in claim 4, further comprising storing the determined 
number of devices and/or links between the device causing me event and the network 
management station for each event. \ 
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6. A method as claimed in claim 2, wherein the step of determining as said event 
comprises the step of: selecting as the event, the event for which the number of 
devices and/or links between the device causing the event and the network 
management station, is the fewest. 



7. A method as claimed in claim 1, wherein prior to the step of considering, the 
method comprises the step of: cfetennining if said plurality of events are related, and if 
it is determined that said plurality of events are related, storing said plurality of 
related events in an event list. 

8. A method as claimed in blaim 7, wherein the step of determining if the 
plurality of events are related comj^ises determining the type of event for each of the 
plurality of events, and determining that said plurality of events are related if the 
events are of a similar type. 

9. A method as claimed in claim 7, wherein the method further comprises: 
receiving each event; and the step of determining if said plurality of events are related 
comprises the steps of: for each event^detemiining the time difference between the 



time of the received event and the time of the immediately preceding event, and 
determining that the received event is related to the immediately preceding event if 
the time difference is less than a predetermined time period. 



10. A method as claimed in claim 9, wherein the predetermined time period is in 
the range 0 seconds to 5 minutes. 

11. A method as claimed in claim 9, wherein, if the received event is determined 
to be related, the method further comprises the Btep of: storing the event in a list of 
related events, and if the received event is determined not to be related, the method 
further comprises the steps of: comparing the type of events in the existing list of 
related events, and selecting events of a similar, relevant type. 
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12. A method as claim&d in claim 7, wherein the method further comprises: 
receiving each event; and theWep of determining if said plurality of events are related 
comprises the steps of: for each event, comparing the type of the received event and 
5 the type of the immediately preceding event, and determining that the received event 
is related to the immediately preceding event if the step of comparing finds the event 
type of the received event is similar to the event type of the immediately preceding 
event. I 

10 13. A method as claimed in\ claim 7, wherein the method further comprises: 
receiving each event; and the steplof determining if said plurality of events are related 
comprises the steps of: for each event, determining the time difference between the 
\ time of the received event and the time of the immediately preceding event, and 

) comparing the type of the receivedlevent and the type of the immediately preceding 

15 event, and determining that the recewed event is related to the immediately preceding 
event if the time difference is less than a predetermined time period and the events are 
similar in type. \ 

14. A method as claimed in claim 113, wherein the predetermined time period is in 
20 the range of 0 seconds to 5 minutes. \ 

15. A method as claimed in claim X further comprising the steps of, receiving 
each event; automatically determining m the event is related to the immediately 
preceding event, and if it is determined tnat the received event is related, storing the 

25 received event in the event list. \ 

16. A method as claimed in claim 15, wHterein, if it is determined that the event is 
not related to the immediately preceding event, the method further comprises storing 
the received event in a new event list. \ 

30 \ 
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^yf^ A network mai^emep^iTCthod, for identifying an event among a plurality of 
events detected by a network managemgHi station on a network, which event is 
indicative of the underlying causeof more than one of said plurality of events, 
substantially as hereinbefore^ described with reference to the accompanying drawings. 



A computer readable medium having a computer program for carrying out the 
method as claimed in claim 1 . 



18. 




On a computer readable medium, a computer program for identifying an event 
among a plurality of events detected by a network management station on a network, 
which event is indicative of the underlying cause of more than one of said plurality of 
events, wherein the network management station knows the topology of the network, 
the computer program comprising: 

program means for considering the location of the network device causing 
each event in the plurality of events, and 

program means for determining as said event, the event which has occurred at 
a location closest to the network management station. 



J2&^~ A network management apparatus for managing a network, comprising a 
network management station having a processor and memory, the memory storing 
data representing the topology of the network, wherein the network management 
station is configured to monitor the iktwork and to generate events in finding 
predefined event conditions; wherein the network management station is further 
configured to identify an event among a plurality of events generated by the network 
management station, which event is indicative of the underlying cause of more than 
one of said plurality of .events, by considering the location of the network device 
causing each event in the plurality of events, and determining as said event, the event 
which has occurred at a location closest to the network management station. 



